RHSA-2026:67552
Vulnerability from csaf_redhat - Published: 2026-09-15 13:31 - Updated: 2026-09-25 14:32Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
rabbitmq-server4.3:
* rabbitmq-server4.3-4.3.6-1.hum1 (aarch64, x86_64)
* rabbitmq-server4.3-4.3.6-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in RabbitMQ, a messaging and streaming broker. Unsanitized virtual host names allow for XSS in the the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. This vulnerability requires high privileges and user interaction, potentially leading to a low impact on confidentiality and integrity.
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host (vhost) connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustion and a denial of service (DoS) for the RabbitMQ broker.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP (Advanced Message Queuing Protocol) URIs, including usernames and passwords, to be written to the broker's log file. An attacker with access to the log files could exploit this to obtain sensitive credentials, leading to unauthorized access to the messaging broker.
4.1 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts. While the impact is primarily cosmetic, it creates an inconsistency in access control for a sensitive operation.
4.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing (CORS) origin, it incorrectly reflects the attacker's origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator's cached credentials. Consequently, an attacker can issue authenticated requests to the management API, potentially leading to unauthorized actions.
8.1 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Important
A flaw was found in RabbitMQ. An authenticated stream client with read access to any stream can exploit a vulnerability in the `get_chunk_selector/1` function. This function processes a client-supplied `chunk_selector` property without proper validation, leading to an atom table exhaustion. Successful exploitation can cause the RabbitMQ broker node to crash, resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. A remote attacker with management privileges could exploit a regular expression (regex) filter in the management API by providing a specially crafted regex to the ?name= filter. This vulnerability, known as Regular Expression Denial of Service (ReDoS), causes excessive CPU consumption and can saturate system schedulers, leading to a Denial of Service (DoS) for the affected system.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service (DoS) for affected services. This vulnerability occurs when the rabbitmq_federation and rabbitmq_federation_management plugins are enabled.
4.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts (vhosts). This exposes sensitive cross-tenant queue names and cluster topology information. This issue occurs when the management plugin is enabled.
4.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting (XSS), exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name (DN). When the TLS listener is configured for peer verification and an administrator views the connection in the management UI, the embedded script executes in the administrator's browser session, potentially leading to full account takeover.
8.7 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Important
A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted ~19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the Erlang Virtual Machine (VM). This results in a complete denial of service for all tenants and protocols on the affected node.
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Important
A flaw was found in RabbitMQ. A highly privileged remote attacker, with the `rabbitmq_stream_management` plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory, leading to a Denial of Service (DoS) due to resource exhaustion.
4.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. A user with management tag and virtual host (vhost) access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, such as exchanges and partitioned stream queues. This leads to a privilege escalation, enabling a user with view-only access to create and manage resources.
4.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. A user with write permission on a consistent-hash exchange and read on a queue can create a binding with an arbitrarily large integer as its routing key, which acts as a hash-ring weight. This unbounded weight causes the broker to allocate a significant amount of memory, potentially leading to a Denial of Service (DoS) across all cluster nodes in the cluster.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP (Advanced Message Queuing Protocol) user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of system resources (atoms), leading to the entire broker node crashing. This can result in a cross-tenant Denial of Service (DoS), making the service unavailable to all users.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers (URIs) with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the /api/shovels endpoint or rabbitmqctl shovel_status command. This leads to the disclosure of sensitive credentials, potentially allowing unauthorized access to other systems.
4.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the rabbitmq user. This could lead to overwriting existing files or creating new files in sensitive directories, potentially allowing for further system compromise.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom table. Successful exploitation leads to a denial of service by crashing the RabbitMQ node.
4.4 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service (DoS) by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom table, leading to a node crash.
4.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in the `rabbitmq_web_mqtt` plugin of RabbitMQ. An unauthenticated remote attacker can exploit a decompression bomb vulnerability by sending a highly-compressed WebSocket frame. This frame, when decompressed, inflates to gigabytes of memory, leading to a Denial of Service (DoS) by crashing the RabbitMQ node. This occurs during the connection process before any authentication is performed.
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Important
A flaw was found in RabbitMQ. An authenticated AMQP 0-9-1 client with publish permissions can exploit a vulnerability in the body assembly process. By declaring an extremely large BodySize and streaming message fragments, the client can bypass size validation, leading to unbounded memory accumulation. This can cause a Denial of Service (DoS) by degrading publisher performance cluster-wide or by exhausting the node's memory.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP (Advanced Message Queuing Protocol) client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine (VM) crashing, resulting in a Denial of Service (DoS) for all connected services and users.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service (ReDoS) vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CPU consumption due to inefficient regular expression evaluation. This can result in a denial of service, impacting the availability of the RabbitMQ service.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Moderate
A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as `use_http_auth=true` for Web-STOMP or `ssl_cert_login=true` for both plugins, an attacker can exploit this vulnerability. This allows an attacker's malicious JavaScript, running in a victim's browser, to authenticate as the victim, potentially leading to unauthorized access or actions within RabbitMQ.
8.1 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-44839
Threats
Impact
Important
References
153 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nrabbitmq-server4.3:\n * rabbitmq-server4.3-4.3.6-1.hum1 (aarch64, x86_64)\n * rabbitmq-server4.3-4.3.6-1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:67552",
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44839",
"url": "https://access.redhat.com/security/cve/CVE-2026-44839"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67221",
"url": "https://access.redhat.com/security/cve/CVE-2026-67221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67219",
"url": "https://access.redhat.com/security/cve/CVE-2026-67219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67224",
"url": "https://access.redhat.com/security/cve/CVE-2026-67224"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67232",
"url": "https://access.redhat.com/security/cve/CVE-2026-67232"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66067",
"url": "https://access.redhat.com/security/cve/CVE-2026-66067"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66077",
"url": "https://access.redhat.com/security/cve/CVE-2026-66077"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66080",
"url": "https://access.redhat.com/security/cve/CVE-2026-66080"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67405",
"url": "https://access.redhat.com/security/cve/CVE-2026-67405"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67228",
"url": "https://access.redhat.com/security/cve/CVE-2026-67228"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67220",
"url": "https://access.redhat.com/security/cve/CVE-2026-67220"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67235",
"url": "https://access.redhat.com/security/cve/CVE-2026-67235"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66074",
"url": "https://access.redhat.com/security/cve/CVE-2026-66074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66069",
"url": "https://access.redhat.com/security/cve/CVE-2026-66069"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66075",
"url": "https://access.redhat.com/security/cve/CVE-2026-66075"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67240",
"url": "https://access.redhat.com/security/cve/CVE-2026-67240"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66076",
"url": "https://access.redhat.com/security/cve/CVE-2026-66076"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66070",
"url": "https://access.redhat.com/security/cve/CVE-2026-66070"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66079",
"url": "https://access.redhat.com/security/cve/CVE-2026-66079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67238",
"url": "https://access.redhat.com/security/cve/CVE-2026-67238"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66072",
"url": "https://access.redhat.com/security/cve/CVE-2026-66072"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67218",
"url": "https://access.redhat.com/security/cve/CVE-2026-67218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66068",
"url": "https://access.redhat.com/security/cve/CVE-2026-66068"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67229",
"url": "https://access.redhat.com/security/cve/CVE-2026-67229"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67552.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-25T14:32:52+00:00",
"generator": {
"date": "2026-09-25T14:32:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:67552",
"initial_release_date": "2026-09-15T13:31:52+00:00",
"revision_history": [
{
"date": "2026-09-15T13:31:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-24T02:11:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-25T14:32:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"product": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"product_id": "rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"product": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"product_id": "rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64",
"product": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64",
"product_id": "rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64"
},
"product_reference": "rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src"
},
"product_reference": "rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
},
"product_reference": "rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44839",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-27T16:02:02.827938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482215"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. \nUnsanitized virtual host names allow for XSS in the the management UI pages that list virtual hosts if the attacker\nmanages to find a way to force a virtual host to restart. This vulnerability requires high privileges and user interaction, potentially leading to a low impact on confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has a Low impact on Red Hat products. An attacker with high privileges could exploit an unsanitized virtual host name in the RabbitMQ management UI, leading to a Cross-Site Scripting (XSS) vulnerability. Successful exploitation requires user interaction and the ability to force a virtual host restart, limiting the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44839"
},
{
"category": "external",
"summary": "RHBZ#2482215",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482215"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44839"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/commit/7f54319279d1ece161ae0b4cdc6f0e58a4045eb5",
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/7f54319279d1ece161ae0b4cdc6f0e58a4045eb5"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fh5r-jpm3-fjwp",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fh5r-jpm3-fjwp"
}
],
"release_date": "2026-05-27T15:07:10.366000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict access to the RabbitMQ management UI to trusted administrators only. Ensure that administrative interfaces are not exposed to untrusted networks.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI"
},
{
"cve": "CVE-2026-66067",
"cwe": {
"id": "CWE-1220",
"name": "Insufficient Granularity of Access Control"
},
"discovery_date": "2026-09-23T20:32:23.579688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host (vhost) connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustion and a denial of service (DoS) for the RabbitMQ broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66067"
},
{
"category": "external",
"summary": "RHBZ#2539766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66067",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66067"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66067",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66067"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-hwqx-2gfg-89qf",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-hwqx-2gfg-89qf"
}
],
"release_date": "2026-09-23T20:12:00.076000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol"
},
{
"cve": "CVE-2026-66068",
"cwe": {
"id": "CWE-215",
"name": "Insertion of Sensitive Information Into Debugging Code"
},
"discovery_date": "2026-09-23T20:40:53.477085+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539769"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP (Advanced Message Queuing Protocol) URIs, including usernames and passwords, to be written to the broker\u0027s log file. An attacker with access to the log files could exploit this to obtain sensitive credentials, leading to unauthorized access to the messaging broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66068"
},
{
"category": "external",
"summary": "RHBZ#2539769",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539769"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66068"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66068",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66068"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9wm4-9m6g-w38x",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9wm4-9m6g-w38x"
}
],
"release_date": "2026-09-23T20:24:35.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs"
},
{
"cve": "CVE-2026-66069",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-09-23T20:31:18.895793+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts. While the impact is primarily cosmetic, it creates an inconsistency in access control for a sensitive operation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. A monitoring-tagged user can reset authentication-attempt counters through the Management API without administrator permission. Broker logs remain intact, so the impact is limited to tampering with security metrics.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66069"
},
{
"category": "external",
"summary": "RHBZ#2539756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66069"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66069",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66069"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fhwq-9rvh-prj2",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fhwq-9rvh-prj2"
}
],
"release_date": "2026-09-23T20:09:28.198000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict Management API access and monitoring-tag accounts, or disable the Management plugin where it is not needed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters"
},
{
"cve": "CVE-2026-66070",
"cwe": {
"id": "CWE-942",
"name": "Permissive Cross-domain Security Policy with Untrusted Domains"
},
"discovery_date": "2026-09-23T20:12:10.769031+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539724"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing (CORS) origin, it incorrectly reflects the attacker\u0027s origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator\u0027s cached credentials. Consequently, an attacker can issue authenticated requests to the management API, potentially leading to unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw IMPORTANT in products that ship affected RabbitMQ builds. If the Management plugin allows wildcard CORS and an administrator has cached HTTP Basic credentials, a malicious website visited by that administrator can make authenticated Management API requests, potentially exposing sensitive information or changing broker configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66070"
},
{
"category": "external",
"summary": "RHBZ#2539724",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539724"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66070"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66070",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66070"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p3hp-v9wh-ghm7",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p3hp-v9wh-ghm7"
}
],
"release_date": "2026-09-23T19:59:58.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Replace wildcard CORS with explicit trusted origins and avoid administrator Basic credentials in browsers used for untrusted sites.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions"
},
{
"cve": "CVE-2026-66072",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:31:47.259285+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539758"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. An authenticated stream client with read access to any stream can exploit a vulnerability in the `get_chunk_selector/1` function. This function processes a client-supplied `chunk_selector` property without proper validation, leading to an atom table exhaustion. Successful exploitation can cause the RabbitMQ broker node to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. With the stream plugin enabled, an authenticated client with read access to a stream can supply a crafted chunk selector, exhaust the broker\u2019s atom table, and crash the node.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66072"
},
{
"category": "external",
"summary": "RHBZ#2539758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539758"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66072"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r"
}
],
"release_date": "2026-09-23T20:13:13.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Disable the stream plugin if unused, and restrict stream access to trusted clients.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector"
},
{
"cve": "CVE-2026-66074",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-09-23T20:52:44.199156+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539788"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. A remote attacker with management privileges could exploit a regular expression (regex) filter in the management API by providing a specially crafted regex to the ?name= filter. This vulnerability, known as Regular Expression Denial of Service (ReDoS), causes excessive CPU consumption and can saturate system schedulers, leading to a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66074"
},
{
"category": "external",
"summary": "RHBZ#2539788",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539788"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66074"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg5q-vcgf-rfh7",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg5q-vcgf-rfh7"
}
],
"release_date": "2026-09-23T20:45:28+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter"
},
{
"cve": "CVE-2026-66075",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-09-23T20:51:29.670333+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539777"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service (DoS) for affected services. This vulnerability occurs when the rabbitmq_federation and rabbitmq_federation_management plugins are enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds because a monitoring-only user can invoke an unauthorized federation-link restart. When the federation and federation-management plugins are enabled, that restart can briefly interrupt cross-cluster message flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66075"
},
{
"category": "external",
"summary": "RHBZ#2539777",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539777"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66075"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g5v3-w5xg-62q2",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g5v3-w5xg-62q2"
}
],
"release_date": "2026-09-23T20:39:59.299000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict monitoring access and disable federation management where it is not needed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw"
},
{
"cve": "CVE-2026-66076",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-09-23T20:11:40.258982+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539721"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts (vhosts). This exposes sensitive cross-tenant queue names and cluster topology information. This issue occurs when the management plugin is enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66076"
},
{
"category": "external",
"summary": "RHBZ#2539721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539721"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66076"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph"
}
],
"release_date": "2026-09-23T19:57:11.906000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass"
},
{
"cve": "CVE-2026-66077",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-09-23T20:32:53.799181+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539765"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting (XSS), exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate\u0027s Subject Distinguished Name (DN). When the TLS listener is configured for peer verification and an administrator views the connection in the management UI, the embedded script executes in the administrator\u0027s browser session, potentially leading to full account takeover.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66077"
},
{
"category": "external",
"summary": "RHBZ#2539765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539765"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66077"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66077",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66077"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38"
}
],
"release_date": "2026-09-23T20:03:42.797000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN"
},
{
"cve": "CVE-2026-66079",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:11:03.509353+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted ~19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the Erlang Virtual Machine (VM). This results in a complete denial of service for all tenants and protocols on the affected node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw IMPORTANT in products that ship affected RabbitMQ builds. An unauthenticated network client can send a small crafted AMQP 1.0 frame to an exposed listener, causing memory exhaustion that crashes the broker node and interrupts service for all tenants and protocols.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66079"
},
{
"category": "external",
"summary": "RHBZ#2539722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66079"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
}
],
"release_date": "2026-09-23T20:01:15.295000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict untrusted network access to AMQP listeners; disable AMQP 1.0 support if unused.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing"
},
{
"cve": "CVE-2026-66080",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:31:27.400824+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. A highly privileged remote attacker, with the `rabbitmq_stream_management` plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory, leading to a Denial of Service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. With the stream-management plugin enabled, a management-tagged user with access to a virtual host can request an excessive number of super-stream partitions, exhausting broker memory and causing a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66080"
},
{
"category": "external",
"summary": "RHBZ#2539757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66080"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66080",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66080"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wg79-5449-m728",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wg79-5449-m728"
}
],
"release_date": "2026-09-23T20:20:34.845000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict management-tagged accounts and disable stream management where it is not needed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation"
},
{
"cve": "CVE-2026-67218",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-09-23T20:51:52.219639+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539778"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. A user with management tag and virtual host (vhost) access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, such as exchanges and partitioned stream queues. This leads to a privilege escalation, enabling a user with view-only access to create and manage resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. With stream management enabled, a user with management and virtual-host access but no configure permission can create persistent super-stream resources through the HTTP API, crossing the intended permission boundary.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67218"
},
{
"category": "external",
"summary": "RHBZ#2539778",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539778"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67218"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34jw-rm7g-hph4",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34jw-rm7g-hph4"
}
],
"release_date": "2026-09-23T20:46:33.316000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict that access or disable stream management where it is not needed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation"
},
{
"cve": "CVE-2026-67219",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-09-23T20:52:30.024994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539785"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. A user with write permission on a consistent-hash exchange and read on a queue can create a binding with an arbitrarily large integer as its routing key, which acts as a hash-ring weight. This unbounded weight causes the broker to allocate a significant amount of memory, potentially leading to a Denial of Service (DoS) across all cluster nodes in the cluster.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67219"
},
{
"category": "external",
"summary": "RHBZ#2539785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539785"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67219"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-m8pg-4x2h-jvgr",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-m8pg-4x2h-jvgr"
}
],
"release_date": "2026-09-23T20:38:42.653000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight"
},
{
"cve": "CVE-2026-67220",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:33:08.542802+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP (Advanced Message Queuing Protocol) user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of system resources (atoms), leading to the entire broker node crashing. This can result in a cross-tenant Denial of Service (DoS), making the service unavailable to all users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. With the JMS topic exchange plugin enabled, an authenticated client with binding permissions can supply crafted selector strings that exhaust the broker\u2019s atom table and crash the node, interrupting service across virtual hosts.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67220"
},
{
"category": "external",
"summary": "RHBZ#2539763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67220"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67220",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67220"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-r3qr-4h63-mvj2",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-r3qr-4h63-mvj2"
}
],
"release_date": "2026-09-23T20:06:48.985000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Disable the JMS topic exchange plugin if unused and restrict binding permissions to trusted users.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion"
},
{
"cve": "CVE-2026-67221",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-09-23T21:01:00.996126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539794"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers (URIs) with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the /api/shovels endpoint or rabbitmqctl shovel_status command. This leads to the disclosure of sensitive credentials, potentially allowing unauthorized access to other systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67221"
},
{
"category": "external",
"summary": "RHBZ#2539794",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539794"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67221"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x5h5-588r-cv55",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x5h5-588r-cv55"
}
],
"release_date": "2026-09-23T20:48:53.210000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords"
},
{
"cve": "CVE-2026-67224",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-09-23T20:32:05.365680+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539762"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the rabbitmq user. This could lead to overwriting existing files or creating new files in sensitive directories, potentially allowing for further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67224"
},
{
"category": "external",
"summary": "RHBZ#2539762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67224"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67224",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67224"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc"
}
],
"release_date": "2026-09-23T20:05:04.923000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write"
},
{
"cve": "CVE-2026-67228",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:51:38.364769+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom table. Successful exploitation leads to a denial of service by crashing the RabbitMQ node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67228"
},
{
"category": "external",
"summary": "RHBZ#2539780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67228"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-73qp-fwh4-2q5g",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-73qp-fwh4-2q5g"
}
],
"release_date": "2026-09-23T20:37:40.477000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component"
},
{
"cve": "CVE-2026-67229",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:41:06.849151+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539770"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service (DoS) by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom table, leading to a node crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67229"
},
{
"category": "external",
"summary": "RHBZ#2539770",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539770"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67229"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67229",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67229"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-ggrw-qm45-hwpv",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-ggrw-qm45-hwpv"
}
],
"release_date": "2026-09-23T20:22:40.596000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata"
},
{
"cve": "CVE-2026-67232",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-09-23T20:52:34.391044+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539787"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `rabbitmq_web_mqtt` plugin of RabbitMQ. An unauthenticated remote attacker can exploit a decompression bomb vulnerability by sending a highly-compressed WebSocket frame. This frame, when decompressed, inflates to gigabytes of memory, leading to a Denial of Service (DoS) by crashing the RabbitMQ node. This occurs during the connection process before any authentication is performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67232"
},
{
"category": "external",
"summary": "RHBZ#2539787",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539787"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67232"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67232",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67232"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gmgx-hhg5-43gr",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gmgx-hhg5-43gr"
}
],
"release_date": "2026-09-23T20:42:23.130000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb"
},
{
"cve": "CVE-2026-67235",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:52:25.599110+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539784"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ. An authenticated AMQP 0-9-1 client with publish permissions can exploit a vulnerability in the body assembly process. By declaring an extremely large BodySize and streaming message fragments, the client can bypass size validation, leading to unbounded memory accumulation. This can cause a Denial of Service (DoS) by degrading publisher performance cluster-wide or by exhausting the node\u0027s memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds using CVSS v3.1; RabbitMQ\u2019s higher severity reflects CVSS v4 scoring of the same attack conditions. An authenticated AMQP 0-9-1 publisher can bypass message body-size validation by declaring an oversized body and streaming fragments, accumulating memory until publishing is impaired cluster-wide or the broker node runs out of memory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67235"
},
{
"category": "external",
"summary": "RHBZ#2539784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539784"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67235"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67235",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67235"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q8g2-pc7m-m3jw",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q8g2-pc7m-m3jw"
}
],
"release_date": "2026-09-23T20:36:37.508000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict publish access to trusted clients; broker memory alarms offer only partial protection until an updated build is deployed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass"
},
{
"cve": "CVE-2026-67238",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T20:11:56.278926+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539723"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP (Advanced Message Queuing Protocol) client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine (VM) crashing, resulting in a Denial of Service (DoS) for all connected services and users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds using CVSS v3.1; RabbitMQ\u2019s higher severity reflects CVSS v4 scoring of the same attack conditions. An authenticated AMQP 0-9-1 client can send crafted reply-to queue names that create permanent atoms until the atom table is exhausted, crashing the broker and interrupting all virtual hosts.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67238"
},
{
"category": "external",
"summary": "RHBZ#2539723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67238"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67238",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67238"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2"
}
],
"release_date": "2026-09-23T19:58:35.019000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Restrict AMQP access to trusted clients until an updated build is deployed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding"
},
{
"cve": "CVE-2026-67240",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-09-23T20:32:37.349027+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service (ReDoS) vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CPU consumption due to inefficient regular expression evaluation. This can result in a denial of service, impacting the availability of the RabbitMQ service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RabbitMQ: RabbitMQ: Denial of Service via crafted AMQP 1.0 SQL LIKE filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67240"
},
{
"category": "external",
"summary": "RHBZ#2539764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67240"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67240",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67240"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2"
}
],
"release_date": "2026-09-23T20:19:22.703000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RabbitMQ: RabbitMQ: Denial of Service via crafted AMQP 1.0 SQL LIKE filter"
},
{
"cve": "CVE-2026-67405",
"cwe": {
"id": "CWE-1385",
"name": "Missing Origin Validation in WebSockets"
},
"discovery_date": "2026-09-23T20:51:15.255127+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RabbitMQ\u0027s Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as `use_http_auth=true` for Web-STOMP or `ssl_cert_login=true` for both plugins, an attacker can exploit this vulnerability. This allows an attacker\u0027s malicious JavaScript, running in a victim\u0027s browser, to authenticate as the victim, potentially leading to unauthorized access or actions within RabbitMQ.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious website may hijack an authenticated RabbitMQ Web-STOMP connection when non-default HTTP authentication or client-certificate login is enabled, or a Web-MQTT connection when client-certificate login is enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67405"
},
{
"category": "external",
"summary": "RHBZ#2539779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67405"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"category": "external",
"summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9c4f-rxxm-88q3",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9c4f-rxxm-88q3"
}
],
"release_date": "2026-09-23T20:41:14.196000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-15T13:31:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67552"
},
{
"category": "workaround",
"details": "Disable Web-STOMP and Web-MQTT where unnecessary, or avoid those non-default authentication options until an updated build is deployed.",
"product_ids": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@src",
"Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…